Skip to content

Commit 2ca6bb5

Browse files
AndriciucAndriciuc
authored
DOCS-KMIP-updates (#337)
initial commit, fixes to code presentation - Updates to kmip with fixes to how we present code (website looks better now!) - Updates set-principal-key with similar fixes - Updated keyring.md with similar fixes And updated functions for two parameters with updates from 1506
1 parent 2dbb8d8 commit 2ca6bb5

File tree

5 files changed

+85
-57
lines changed

5 files changed

+85
-57
lines changed

‎contrib/pg_tde/documentation/docs/functions.md‎

Lines changed: 33 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -106,15 +106,43 @@ The KMIP provider uses a remote KMIP server.
106106
Use these functions to add a KMIP provider:
107107

108108
```sql
109-
SELECT pg_tde_add_database_key_provider_kmip('provider-name','kmip-addr', `port`, '/path_to/server_certificate.pem', '/path_to/client_cert.pem', '/path_to/client_key.pem');
110-
SELECT pg_tde_add_global_key_provider_kmip('provider-name','kmip-addr', `port`, '/path_to/server_certificate.pem', '/path_to/client_cert.pem', '/path_to/client_key.pem');
109+
SELECT pg_tde_add_database_key_provider_kmip(
110+
'provider-name',
111+
'kmip-addr',
112+
`port`,
113+
'/path_to/server_certificate.pem',
114+
'/path_to/client_cert.pem',
115+
'/path_to/client_key.pem'
116+
);
117+
SELECT pg_tde_add_global_key_provider_kmip(
118+
'provider-name',
119+
'kmip-addr',
120+
`port`,
121+
'/path_to/server_certificate.pem',
122+
'/path_to/client_certificate.pem',
123+
'/path_to/client_key.pem'
124+
);
111125
```
112126

113127
These functions change the KMIP provider:
114128

115129
```sql
116-
SELECT pg_tde_change_database_key_provider_kmip('provider-name','kmip-addr', `port`, '/path_to/server_certificate.pem', '/path_to/client_cert.pem', '/path_to/client_key.pem');
117-
SELECT pg_tde_change_global_key_provider_kmip('provider-name','kmip-addr', `port`, '/path_to/server_certificate.pem', '/path_to/client_cert.pem', '/path_to/client_key.pem');
130+
SELECT pg_tde_change_database_key_provider_kmip(
131+
'provider-name',
132+
'kmip-addr',
133+
`port`,
134+
'/path_to/server_certificate.pem',
135+
'/path_to/client_cert.pem',
136+
'/path_to/client_key.pem'
137+
);
138+
SELECT pg_tde_change_global_key_provider_kmip(
139+
'provider-name',
140+
'kmip-addr',
141+
`port`,
142+
'/path_to/server_certificate.pem',
143+
'/path_to/client_certificate.pem',
144+
'/path_to/client_key.pem'
145+
);
118146
```
119147

120148
where:
@@ -124,7 +152,7 @@ where:
124152
* `port` is the port to communicate with the KMIP server.
125153
Most KMIP servers use port 5696.
126154
* `server-certificate` is the path to the certificate file for the KMIP server.
127-
* `client-cert` is the path to the client certificate.
155+
* `client-certificate` is the path to the client certificate.
128156
* `client-key` is the path to the client key.
129157

130158
The specified access parameters require permission to read and write keys at the server.

‎contrib/pg_tde/documentation/docs/global-key-provider-configuration/keyring.md‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,23 +3,22 @@
33
This setup is intended for development and stores the keys unencrypted in the specified data file. See [how to use external reference to parameters](../how-to/external-parameters.md) to add an extra security layer to your setup.
44

55
!!! note
6-
76
While keyfiles may be acceptable for **local** or **testing environments**, KMS integration is the recommended approach for production deployments.
87

98
```sql
10-
SELECT pg_tde_add_global_key_provider_file(
11-
'provider-name',
12-
'/path/to/the/keyring/data.file'
13-
);
9+
SELECT pg_tde_add_global_key_provider_file(
10+
'provider-name',
11+
'/path/to/the/keyring/data.file'
12+
);
1413
```
1514

1615
The following example is used for testing purposes only:
1716

1817
```sql
19-
SELECT pg_tde_add_global_key_provider_file(
20-
'file-keyring',
21-
'/tmp/pg_tde_test_local_keyring.per'
22-
);
18+
SELECT pg_tde_add_global_key_provider_file(
19+
'file-keyring',
20+
'/tmp/pg_tde_test_local_keyring.per'
21+
);
2322
```
2423

2524
## Next steps

‎contrib/pg_tde/documentation/docs/global-key-provider-configuration/kmip-server.md‎

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
To use a Key Management Interoperability Protocol (KMIP) server with `pg_tde`, you must configure it as a global key provider. This setup enables `pg_tde` to securely fetch and manage encryption keys from a centralized key management appliance.
44

55
!!! note
6-
76
You need the root certificate of the KMIP server and a client key/certificate pair with permissions to create and read keys on the server.
87

98
It is recommended to review the [configuration guidelines for the HashiCorp Vault Enterprise KMIP Secrets Engine](https://developer.hashicorp.com/vault/tutorials/enterprise/kmip-engine) if you're using Vault.
@@ -12,16 +11,16 @@ For testing purposes, you can use a lightweight PyKMIP server, which enables eas
1211

1312
## Example usage
1413

15-
```sql
16-
SELECT pg_tde_add_global_key_provider_kmip(
17-
'provider-name',
18-
'kmip-IP',
19-
5696,
20-
'/path_to/server_certificate.pem',
21-
'/path_to/client_cert.pem',
22-
'/path_to/client_key.pem'
23-
);
24-
```
14+
```sql
15+
SELECT pg_tde_add_global_key_provider_kmip(
16+
'provider-name',
17+
'kmip-IP',
18+
5696,
19+
'/path_to/server_certificate.pem',
20+
'/path_to/client_cert.pem',
21+
'/path_to/client_key.pem'
22+
);
23+
```
2524

2625
## Parameter descriptions
2726

@@ -36,15 +35,15 @@ For testing purposes, you can use a lightweight PyKMIP server, which enables eas
3635

3736
The following example is for testing purposes only.
3837

39-
```sql
40-
SELECT pg_tde_add_global_key_provider_kmip(
41-
'kmip','127.0.0.1',
42-
5696,
43-
'/tmp/server_certificate.pem',
44-
'/tmp/client_cert_jane_doe.pem',
45-
'/tmp/client_key_jane_doe.pem'
46-
);
47-
```
38+
```sql
39+
SELECT pg_tde_add_global_key_provider_kmip(
40+
'kmip','127.0.0.1',
41+
5696,
42+
'/tmp/server_certificate.pem',
43+
'/tmp/client_cert_jane_doe.pem',
44+
'/tmp/client_key_jane_doe.pem'
45+
);
46+
```
4847

4948
For more information on related functions, see the link below:
5049

‎contrib/pg_tde/documentation/docs/global-key-provider-configuration/set-principal-key.md‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ You can configure a default principal key using a global key provider. This key
77
Run the following command:
88

99
```sql
10-
SELECT pg_tde_set_default_key_using_global_key_provider(
11-
'name-of-the-key',
12-
'provider-name',
13-
'ensure_new_key'
14-
);
10+
SELECT pg_tde_set_default_key_using_global_key_provider(
11+
'name-of-the-key',
12+
'provider-name',
13+
'ensure_new_key'
14+
);
1515
```
1616

1717
## Parameter description
@@ -23,12 +23,15 @@ Run the following command:
2323
This example is for testing purposes only. Replace the key name and provider name with your values:
2424

2525
```sql
26-
SELECT pg_tde_set_key_using_global_key_provider('test-db-master-key','file-vault','ensure_new_key');
26+
SELECT pg_tde_set_key_using_global_key_provider(
27+
'test-db-master-key',
28+
'file-vault',
29+
'ensure_new_key'
30+
);
2731
```
2832

2933
!!! note
30-
31-
The key is auto-generated.
34+
The key is auto-generated.
3235

3336
After this, all databases that do not have something else configured will use this newly generated principal key.
3437

‎contrib/pg_tde/documentation/docs/global-key-provider-configuration/vault.md‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,18 @@
33
You can configure `pg_tde` to use HashiCorp Vault as a global key provider for managing encryption keys securely.
44

55
!!! note
6-
76
This guide assumes that your Vault server is already set up and accessible. Vault configuration is outside the scope of this document, see [Vault's official documentation](https://developer.hashicorp.com/vault/docs) for more information.
87

98
## Example usage
109

1110
```sql
12-
SELECT pg_tde_add_global_key_provider_vault_v2(
13-
'provider-name',
14-
'secret_token',
15-
'url',
16-
'mount',
17-
'ca_path'
18-
);
11+
SELECT pg_tde_add_global_key_provider_vault_v2(
12+
'provider-name',
13+
'secret_token',
14+
'url',
15+
'mount',
16+
'ca_path'
17+
);
1918
```
2019

2120
## Parameter descriptions
@@ -29,13 +28,13 @@ You can configure `pg_tde` to use HashiCorp Vault as a global key provider for m
2928
The following example is for testing purposes only. Use secure tokens and proper SSL validation in production environments:
3029

3130
```sql
32-
SELECT pg_tde_add_global_key_provider_vault_v2(
33-
'my-vault',
34-
'hvs.zPuyktykA...example...ewUEnIRVaKoBzs2',
35-
'http://vault.vault.svc.cluster.local:8200',
36-
'secret/data',
37-
NULL
38-
);
31+
SELECT pg_tde_add_global_key_provider_vault_v2(
32+
'my-vault',
33+
'hvs.zPuyktykA...example...ewUEnIRVaKoBzs2',
34+
'http://vault.vault.svc.cluster.local:8200',
35+
'secret/data',
36+
NULL
37+
);
3938
```
4039

4140
For more information on related functions, see the link below:

0 commit comments

Comments
 (0)